[hyperpolymath]

Fix

Remove the second timeout-minutes key from the Julia job in .github/workflows/ci.yml. Retain the explicit 90-minute budget and all existing tests, relevance gates, and required context names.

#243 merged as a9fb609 with overlapping 90- and 60-minute YAML keys. Main workflow run 39990718300 consequently failed before jobs could start. This is a focused three-line repair, not a waiver of CI.

This carries the exact tree of #247 (46665dd) onto the current session branch with the repository-required DCO signoff; #247's commit has no Signed-off-by:. The commit parent is current main a9fb609, with no merge commit and no other file changes. Duplicate replacement #252 was closed after #243 merged.

Verification on the exact tree

• Governance contract: 39/39 passed; all 8 weakening mutations rejected
• CI producer/logger exit combinations: 4/4 passed; K9 optional-log cases: 3/3 passed
• Scanner boundaries: working-tree and deleted-history shell credentials blocked without disclosure; Rust findings redacted; all six clean/error/finding AsciiDoc cases passed
• Unique-key YAML parsing passed for 11 files; bash -n passed for 84 embedded run blocks
• Equivalent local clone: full-history custom shell scan and real Gitleaks 8.30.1 working-tree/history scans clean
• git diff --check passed
• Post-Harden security checks and separate K9/DEED governance evidence #243 default-branch Scorecard run 39990720761 succeeded through analysis, SARIF upload, and artifact upload

Julia/R execution requires hosted CI; no local runtime pass is claimed. #247's hosted run 39990855274 is testing the same tree, but this commit will also retain its own fresh checks.

Scope

• Current-main ordinary commit with Signed-off-by: (DCO)
• Only .github/workflows/ci.yml changed
• No application, dependency, licence, generated, or vendored-file changes

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 13 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ba9508f1-e230-4936-a74a-7be59ce4e793

📥 Commits

Reviewing files that changed from the base of the PR and between a9fb609 and deea730.

📒 Files selected for processing: 1

• .github/workflows/ci.yml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Fork governance

Lane	Status	Run
DEED syntax (repo deed)	🟢 conformant	run 39991607291
K9 conformance (L0–L2; L3 not verified)	green (job: success)	same run
Hypatia verdict grid	purple (job: success)	same run

🟣 critical · commit deea730c959f · run 39991607291

Reporter	Status	Critical	High	Medium	Minor	Since previous revision
Hypatia scan	🟣 critical	45	57	26	0	— no comparable baseline
panic-attack assail	🔴 high	0	6	11	0	— no comparable baseline
pons asinorum	🟡 medium	0	0	1	0	— no comparable baseline
rhodibot (RSR compliance)	🟠 indeterminate	0	0	0	0	— no comparable baseline
panicbot (panic recovery, error handling)	🟠 indeterminate	0	0	0	0	— no comparable baseline
echidnabot (formal verification: proofs/)	🟠 indeterminate	0	0	0	0	— no comparable baseline
seambot (integration health: API routes)	🟠 indeterminate	0	0	0	0	— no comparable baseline
finishingbot (release readiness)	🟠 indeterminate	0	0	0	0	— no comparable baseline
accessibilitybot (WCAG on the React UI)	🟠 indeterminate	0	0	0	0	— no comparable baseline
glambot (presentation quality)	🟠 indeterminate	0	0	0	0	— no comparable baseline
cipherbot	⚪ not applicable	0	0	0	0	— no comparable baseline
sustainabot	⚪ not applicable	0	0	0	0	— no comparable baseline

Hypatia scan: 128 finding(s)

• critical cicd_rules/banned_language_file — frontend/src/views/run/parseFilterYaml.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/figure/encode.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/figure/charts.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/figure/export.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/figure/figure.test.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/figure/legend.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/figure/types.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/utils/download.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/utils/text.test.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/utils/timeago.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/utils/text.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useUnsavedGuard.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useApi.test.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useApi.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useAnalysis.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useSSE.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useTabParam.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useNavRefresh.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useJobEvents.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/about.ts — TypeScript file detected -- banned language
• 108 more; see the structured report in the artifact.

panic-attack assail: 17 finding(s)

• high DynamicCodeExecution — src/pipeline/dada2/context.jl — eval/Meta.parse in src/pipeline/dada2/context.jl
• high DynamicCodeExecution — src/analysis/analysis.jl — eval/Meta.parse in src/analysis/analysis.jl
• high DynamicCodeExecution — src/analysis/differential.jl — eval/Meta.parse in src/analysis/differential.jl
• high DynamicCodeExecution — src/core/provenance.jl — eval/Meta.parse in src/core/provenance.jl
• high DynamicCodeExecution — scripts/check-julia-syntax.jl — eval/Meta.parse in scripts/check-julia-syntax.jl
• high DynamicCodeExecution — test/unit/test_permanova.jl — eval/Meta.parse in test/unit/test_permanova.jl
• medium UnsafeFFI — src/core/memory_probe.jl — 3 ccall/FFI calls in src/core/memory_probe.jl
• medium InputBoundary — src/server/routes/runs.jl — 2 JSON3.read/JSON.parse call(s) with 0 try block(s) in src/server/routes/runs.jl — these throw on malformed input; wrap in try/catch
• medium InputBoundary — src/server/routes/composition.jl — 6 JSON3.read/JSON.parse call(s) with 2 try block(s) in src/server/routes/composition.jl — these throw on malformed input; wrap in try/catch
• medium InputBoundary — src/server/routes/studies.jl — 4 JSON3.read/JSON.parse call(s) with 2 try block(s) in src/server/routes/studies.jl — these throw on malformed input; wrap in try/catch
• medium InputBoundary — src/server/routes/analysis.jl — 9 JSON3.read/JSON.parse call(s) with 4 try block(s) in src/server/routes/analysis.jl — these throw on malformed input; wrap in try/catch
• medium UnsafeFFI — install.jl — 1 ccall/FFI calls in install.jl
• medium ProofDrift — test/unit/test_occupancy_grade.jl — 2 `@test x isa Y` assertion(s) with no value check — type-only tests may substitute for an unwritten formal theorem in test/unit/test_occupancy_grade.jl
• medium ProofDrift — test/unit/test_evidence.jl — 1 `@test x isa Y` assertion(s) with no value check — type-only tests may substitute for an unwritten formal theorem in test/unit/test_evidence.jl
• medium InputBoundary — bench/advanced_zero_handling/benchmark.jl — 1 JSON3.read/JSON.parse call(s) with 0 try block(s) in bench/advanced_zero_handling/benchmark.jl — these throw on malformed input; wrap in try/catch
• medium InputBoundary — frontend/src/figure/charts.ts — 1 JSON.parse call(s) with 0 try block(s) in frontend/src/figure/charts.ts — JSON.parse throws SyntaxError on malformed input; wrap in try-catch
• medium InputBoundary — frontend/src/components/alphaMetrics.tsx — 1 JSON.parse call(s) with 0 try block(s) in frontend/src/components/alphaMetrics.tsx — JSON.parse throws SyntaxError on malformed input; wrap in try-catch

pons asinorum: 1 finding(s)

• medium unreachable-after-jump — ./frontend/src/components/PublicationTablesPanel.tsx:208 — statement is unreachable after an unconditional jump (T0, HEURISTIC)

rhodibot (RSR compliance): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

panicbot (panic recovery, error handling): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

echidnabot (formal verification: proofs/): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

seambot (integration health: API routes): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

finishingbot (release readiness): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

accessibilitybot (WCAG on the React UI): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

glambot (presentation quality): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

cipherbot: not_applicable — no cryptography is implemented in this repository

• ⚪ not applicable: no cryptography is implemented in this repository

sustainabot: not_applicable — fleet adapter slot reserved; no adapter exists yet (gitbot-fleet README)

• ⚪ not applicable: fleet adapter slot reserved; no adapter exists yet (gitbot-fleet README)

Scope: static findings reported by each row's tool at the named commit. Purple, red, yellow and blue grade the worst finding present; orange is evidence missing, malformed or a scanner that did not run; grey is an explicit scope exclusion with its reason. No row is a security certification. report.json, badge.json and the raw findings are in the verdict-grid artifact on the linked run.

🟢 conformant · commit deea730c959f · run 39991607291 · validator hyperpolymath/standards@c6d78606f392

Category	Status	Pass	Fail	Indeterminate	N/A	Since previous revision
K9 contract typecheck	🟢 conformant	1	0	0	0	— no comparable baseline
K9 validator self-test	🟢 conformant	37	0	0	0	— no comparable baseline
K9 live corpus (L0–L2)	⚪ not applicable	0	0	0	1	— no comparable baseline

K9 live corpus (L0–L2): 1 finding(s) / scope notes

• live corpus — not_applicable: No tracked K9 contracts or routing files.

Scope: K9 components L0–L2 against contract v1.0.0 at the named standards commit. L3 signature verification and routed coordination-dialect files are not certified. Green is limited to this scope. Orange is missing evidence; yellow is grandfathered debt or warnings; grey is an explicit scope exclusion. report.json, badge.json and the validator logs are in the k9-grid artifact on the linked run.